Add cors for OPTIONS (partial)