removed same origin protection to be able to embed dashboards