handle cross origin requests