Wouldn't the browser still make the request even with the CORS headers, because the server needs to send such headers?