improve CORS support

- allow support of pre-flight requests