Allowing cross-domain requests, OPTIONS action/method