Add CORS header (.htaccess doesn’t work?)