Augmented CORS header and now intercepts OPTIONS preflight