Allow OPTIONS methods to bypass authentication to support CORS.

Hey mikedeboer! :D Might surprise you to see me fiddling with this, but in my spare time, I'm hacking on a potential Thunderbird address book rework. Still very vapour-y, but I thought I might use jsDAV as a CardDAV test-server. Ran into this bug (at least, I think it's a bug), and thought you might want the patch.

CORS requires a pre-flight OPTIONS request to be sent to the server
in order for the client to know what methods, origins, headers, etc.
are allowed. This pre-flight request should not request authentication.

See http://stackoverflow.com/questions/15734031/why-does-the-preflight-options-request-of-an-authenticated-cors-request-work-in