fixes preflight request executing the protected route