Also allow the AccessToken header.
No need to write an empty response on an OPTIONS request.
Merge pull request #1357 from adam-rightshift/master

CORSInterceptor