adding options endpoint for CORS support