Cross-domain API test
- FIX: requires special CORS headers & OPTIONS logic