add request preflight, disable HMAC by default