added preflight method to answer OPTIONS calls and allow CORS