No CSRF token on options request

When using CORS a CSRF cookie in the response to an OPTIONS request would cause the CSRF token validation on the following POST request to fail because there was a new token generated for the OPTIONS request.