don't operate CORS for same origin