Cross Domain OPTIONS will allow-cross-origin

This has been discussed in excruciating detail I suggest looking there with regards to how to configure CORS. The trick is usually to either have Tyk handle CORS, or your back end, but never both.