Allow CORS for OPTIONS as well