fix for preflight CORS OPTIONS requests