fix(middleware): classify CORS preflight per Fetch standard

fix(middleware): classify CORS preflight per Fetch standard #1626