Putting this amongst auth makes me a little nervous too. Right now, the only `.all` route we have is proxy, but if someone adds another, it might be compromised. Plus the usual possibility of surprises.

Could this be done in separate middleware before the token require? We could decide there if `OPTIONS` is supported on the path and respond or pass through. In the event of a passthrough, we're not messing with when tokens are or aren't required.