strange fix to CORS issue - move CORS middleware to top, respond with
200 if OPTIONS request