Browsers use OPTIONS preflight request to do CORS validation. Servers shouldn't do too much work in an OPTIONS request. Should be a simple if statement, no db operations, which is usually where the bottleneck is.