setting cors headers for OPTION method only