OSS Img load test
Ref:
Why isn't 'Vary: Origin' response set on a CORS miss?
Img:
Canvas