cross domain is safer