Add CORS headers
Allow unauthenticated OPTIONS verb