Handle CORS preflight requests