added do_OPTIONS fixing CORS