is the resource CORS'd?