Allow OPTIONS method against token & collection routes #363
Description
When CORS is enabled (config:"cors": true) we send back 'Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS', but then OPTIONS requests to /token and any collection route 404