fetch with cors, should get 304, but with cors headers; browser should merge stored response with new headers