HTTP Method OPTIONS Always allowed in CORSResource