added preflight for CORS