added tests for OPTIONS and CORS