Update CORS support for OPTIONS