add OPTIONS method for cross-origin requests