Move OPTIONS route out of auth filter