CORS filter for handling preflight requests