Shouldn't OPTIONS only work when a token is given for an authenticated endpoint anyway? (it can be passed in the Authorization/bearer header pattern too)