Dry up options and headers logic, allow headers to be passed to OPTIONS requests

- fixes quite a few edge cases surrounding middleware not being run