Handle OPTIONS request for CORS