client to test CORS