Reply with CORS headers, don't peform query on OPTIONS