changed CORS handling for preflight options call