Also allow the AccessToken header.
No need to write an empty response on an OPTIONS request.