Tests for the CORS preflight