Only same-origin requests are allowed