fix: options not allowed when cors