better cors testing