CORS headers and tests writen, assuming CORS is always the case