Refactor CORSFilter to only add Access-Control headers if request is
OPTIONS