Basic Auth in web.xml: Exclude OPTIONS request.