api requests only work with origin of www host