I see one use-case where we could get unwanted results, but it remains harmless:
- an AJAX request is sent to an invalid URI, `/api/ezp/v2/blabla` (doesn't have to be a REST one)
- the browser sends a preflight request to this URI with the OPTIONS method and the requested verb
- the route is not found, and the provider silently returns an empty array

Since the requested method isn't returned by any provider (unless there is a global configuration, but it's not _our_ problem), the response will be a 405 Method Not Allowed.

Since it is only the preflight request, the CORS request will just fail.

Do you think we need to cover this ?