Added missing OPTION response for CORS preflight request to fix bug in hitting /auth/ endpoint properly.