handle OPTIONS request