OPTIONS accepted, CORS enabled for any 404