HTTP OPTIONS and Default page vulnerabilities