feat: add default OPTIONS pre-flight response for CORS