Fix deleting of API Sign-On token on HEAD request

See comment inline in code for an explanation
If the third-party implemented integration in JavaScript this is probably HTTP OPTIONS followed by HTTP GET rather than HEAD followed by GET. This OPTIONS+GET is part of the CORS standard. Most modern browsers will do it. https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Preflighted_requests

We should also make sure we are sending appropriate CORS headers so we don't get blocked.

I though the 3rd party was supposed to run this code on their server, in which case no pre-flighting should occur.