let OPTIONS pass

When doing CORS requests, AngularJS sends a preflight OPTIONS request, that does not expose the authorization header. This is standard, please see https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS

Those requests are blocked by express-jwt, even though the following POST / GET request contain the correct header. The existence of authorization headers in the requests following OPTIONS, can be evaluated by checking the contents of OPTIONS request header called Access-Control-Request-Headers. If 'authorization' is inside that header, the following request will contain an Authorization header. There is no way to check if the authorization data is valid, as the OPTIONS request does not expose them. 

This commit allows preflight OPTIONS requests that are passed before GET / POSTS requests that contain the Authorization header.