cross-origin policies for git embed