what specifically does the OPTIONS request need to return?