s3 on the client with CORS