Fix CORS spec warning

Use `success` rather than `done` so that we can stub the method and never actually make a request