add CORS options route (experimental)