Handle CORS OPTIONS requests