For security, a page can only make an AJAX call to where it's from (with IE7 & Vista, even this is not 100% true), and I wish it will always stay like this, otherwise who knows what the freaks will do.

You have to do a server side mesh up, so that the client side won't deal with a second site.