preflight requests middleware