add options to CORS methods