Omit OPTIONS from the safe requests so that it gives an honest CORS preflight response to clients looking to make unsafe requets.