enable OPTIONS and allow Authorization header on CORS