Added a default response for all OPTIONS request that don't match a route.

OPTIONS requests that have routes matching other verbs should never
404. They should always return a 200 with the allowed methods in the
headers.