The implementation can happen as a Role (similar to CORS, possibly merging CORS support in the same Role)
or in Plack::Middleware. (see also the links in
MBS-6033 for already available modules).
This might need tests in order to check that CORS and OPTIONS are working in separate requests (and together?).
See also the conversation in #musicbrainz-devel