CORS on OPTIONS method

Fixed the lack of CORS headers on OPTIONS request