Add cors handling, allow OPTIONS requests