API: allow cross-domain javascript requests