fix for CORS requesting OPTIONS