testing hack cors