Ignore authentication headers for OPTIONS

We need to ignore authentication headers for OPTIONS to avoid unwanted interactions with CORS.
Chrome and Firefox issue a preflight OPTIONS request to check Access-Control-* headers, and will fail if it returns 401.

More at https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Overview