Add tests for cors headers