draft support for correct handling of CORS preflight