added test for CORS