added CORS caching header to reduce preflights dramatically