add OPTIONS to cors allowed methods