add allowOrigin to example of CorsPreflight usage