propperly handing cross-origin requests #1