Support CORS preflight requests for POST action, closes #11