Allow for cross-origin requests via xhr