Add 3 more tests with Access-Control-Allow-Headers checking