add test for /api/sync CORS check