returns 200 HTTP status code to deal with CORS headers