Refactor CORSFilter to only add Access-Control header fields if request is OPTIONS