Allow cross-origin OPTION requests + associated tests