Support authenticated and preflight CORS requests