CORS pre-flight with empty request method