Handle preflight CORS OPTIONS requests

- Allow cache-control header from clients for realtime buckets
- Clients should cache OPTIONS response aka preflight result for 1 day