Good point! There should be an extra handler which let pass preflighted OPTIONS requests. According to the [spec](http://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0) preflighted OPTIONS requests must exclude user authentication.