When you check the requests that your iAPI will receive, you will notice that each request is send two times. This is the browser who make a "preflight" request to the server hosting the cross-origin resource, in order to check that the server will permit the actual request. It is a good practice to test on this, so you don't spend time processing the request, creating and returning the json, which will not be used.
As soon as you get a request, you can check the command of the request. In case it is the OPTION command, you can do the following.
Set the headers for the response as you can see in Cors problems.
Return the following JSON: { "error":"OPTIONS, browser pre-test"}
This way the browser will get a valid response and will proceed. This way there is no time lost in validating the request.
