test CORS and jsonP for js cross-origin-access.