short-circuit the controller action for OPTIONS requests

Previously, the OPTIONS request was actually processing the data as if it were a POST, which is definitely not what we want.