Fixing headers for OPTIONS requests, which impacted CORS