putting through a request with CORS workaround