filter correctly handles preflight requests