use cors headers in options request