Follow up to D337, enable OPTIONS and CORS headers for REST controllers