Disable security for OPTIONS requests.
Allow Authorization header in CORS.