allowed cross domain scripting