since OPTIONS doesn't post cookie, we need to bypass auth
add alwaysDetectHostname option