testing CORS settings