FIX: Reenable and enhanced crossdomain access check due to different
behaviour of browsers
UPD: Allow all heade fields
ADD: Tests for cross domain acces