add CORS tests now that config is dynamic