CORS pre-flight without request method