public contents allow cross site get requests