The default API controller now responds to OPTIONS