1. Plain <img> — not CORS-gated
2. fetch() — needs CORS
3. canvas readback — needs CORS