CORS compliance + fixtures