respond with 200 on options calls
unit test coverage for CORS