fix issue 3 by intercepting CORS preflight requests and creating an empty response for it