don't return OPTIONS as an allowed method to CORS preflights