testing with xml cross-origin