We bypass authentication for all OPTIONS verbs except /proxy, meaning that you can do `OPTIONS /services/dropbox` without an access token (which just returns `Allow: GET`) but not to `/proxy/dropbox`--that one still requires an access token.