fir auth issue; tested for OPTIONS