Don't send Authorization header when it's not needed

CORS specification specifies "simple request", which does not need a
preflight OPTIONS request. The only thing, which we send and is
forbidding to send simple requests is Authorization header, which is not
needed for public endpoints.