fix CORS tests