I could do something awkward like .... add my own middleware to handle Access-Control, then supertokens' middleware, then my actual handler