Making CORS work

Adding handling of browser "OPTIONS" web call (which is a call made by browsers prior to issuing a POST or DELETE in CORS cases)
I find these lines a bit hard to reason about. Could we pull the two scenarios out into a separate methods with meaningful names?