cross origin request update but async won't work :(