Prevent Basic Auth from breaking CORS OPTIONS preflight requests

TItle says it all. Fixes #12.