allow cross origin requests to support javascript hack