short-circuit the controller action for OPTIONS requests