The OPTIONS verb was left out in the previous (XHR proxy fix) commit.

It is also an HTTP verb that should be supported by CORS (in the xhr
proxy).

I hastily pushed commit 8462f02fe161f8bf75379a933f62ccefd26903b9
and missed this.