Bypass authentication/authorization for OPTIONS requests

- mainly to allow CORS support. Besides, OPTIONS should always be available, and
  indicate things like authentication/authorization requirements.
Merge branch 'hotfix/options'

Allow OPTIONS requests regardless of auth requirements