testing anon CORS stuff with image loading