allow_cors handler only returns Allow-Headers header for OPTIONS method