OPTIONS is made only in cross-domain requests