rgw: don't try to authenticate a CORS preflight request

Fixes: #8718
Backport: firefly

CORS preflight requests don't need to be authenticated. Treat them as
coming from anonymous user.

Reported-by: Robert Hubbard <bobby.hubbard@garmin.com>
Signed-off-by: Yehuda Sadeh <yehuda@redhat.com>