[Echo Loader, canvases] use proper way to mock CORS requests