1. Plain <img> — not CORS-gated

2. fetch() — needs CORS

3. canvas readback — needs CORS