test cors setting