Boolean bug in CORS preflight fetch