test CORS delete request