What security mechanism prevents a web page from making requests to a different domain than the one that served it, unless explicitly permitted?