XHR CORS tests