adding OPTIONS to allowed HTTP actions for access control origin