All OPTIONS requests and Authorization headers in CORS requests