add in CORS test