Allow OPTIONS requests, too
Test that CORS headers are present