Not sure why OPTIONS was set to send a 401, but that was breaking CORS.