We need to set Cross-Origin Resource Sharing on the verification url as defined at: https://developer.mozilla.org/en/http_access_control The short version is that you add this header to the response: Access-Control-Allow-Origin: *

We already have a decorator for this (allowing GET requests) in apps.stats.decorators.allow_cross_site_request I don't know what the verification URL is though. If there is any question about long term affects please get security involved before patching.