crude way of setting CORS on OPTIONS call