OPTIONS request should not redirect

Currently the Host checking middleware is mounted before the CORS middleware. If the incoming Host is valid but not the canonical one, OPTIONS request should still return 200 instead of 3xx.

Start by locating the Host checking middleware and the CORS middleware, then reproduce an OPTIONS request with a valid but non-canonical Host. Trace the middleware order and verify that the request returns 200 rather than a 3xx redirect while preserving the existing behavior for other requests.

Written by the indexing model from the issue text.