testing CORS openup