Allow OPTIONS requests for CORS

Change-Id: I74c1f34f383ec424266b9540328ede6d4d2775b6