Ignore authentication headers for OPTIONS

We need to ignore authentication headers for OPTIONS to avoid
unwanted interactions with CORS.
Chrome and Firefox issue a preflight OPTIONS request to check
Access-Control-* headers, and will fail if it returns 401.

https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Overview