Test for access-allow-origin policies