client: Handle cross-origin on same domain