use xdomain instead of CORS