first, fetch in iframe from another origin

then, fetch with cors, should get 304, but with cors headers; browser should merge stored response with new headers