Actually, OPTIONS is okay (and needed for CORS)