Add route to minimal preflight method for CORS
Just render :show instead of redirecting to it.

The prior way won’t play well with CORS, and this produces the same end result.
Use Rack::Cors for CORS configuration