Fix CORS preflight header bug