fix cors with OPTIONS