corsSpec: add 'ensures, when being false and making cross-origin request, that no callbacks are called, except "finished" with Error'