the fetch happens - cors just prevents the client from receiving the body - ignoring cors preflights