test for CORS preflights