Add preflight DELETE handler & return entity in POST response body
polishing CORs for Installations endpoint