FIX: Missing Access-Control-Allow-Origin header after CORS preflight request (fixes #116)