CORS Authorization, Auth middleware passes options.
don't auth static resource requests.