update test for allow-origin