Respond to preflight OPTIONS to allow CORS to work