test now skipping cors and authentication