Don't check auth on OPTIONS requests.