prevent OPTIONS CORS request