Screen auth: allow HTTP Basic using CORS login

Accept a preflight request from the client browser so that local JS can
obtain an authentication cookie for the screen given the correct
authorization token.