use data url to workaround CORS problem