allow OPTIONS for cors requests