Unprotect server sent route

also added options method checking to help with preflighting for CORS.