Add Allow-Origin header to the preflight response.