simple website, yet not working because of same origin policy