fixed #3 by intercepting CORS preflight requests and creating an empty response for it