Move adding CORS headers to a separate method and support HTTP OPTIONS