Added options route again; testing CORS headers