CORS pre-flight issues with /authorize endpoint requests