first, fetch via iframe without Origin request header

then, fetch with cors, should get 304, but with cors headers; browser should merge stored response with new headers