added OPTIONS to CORS handler