test for CORS whiteList