CORS was allowed