fix cors options request for routes deeper than one level