CORS response testing