load crossOriginWhitelist from window.ENV, close #218
fixed README link
0.6.2
Merge branch 'next'