fix OPTIONS request for api endpoints