added route to catch invalid CORS preflight requests and added tests