testing .get for cors support