added CORS OPTIONS support to use endpoints