bypass permission checks for OPTIONS requests

OPTIONS requests, ala CORS, do not supply authentication arguments.