Fix access token, and checking access for correct account

* We need to check access for the passed $account not the active user
* We need to allow POSTing using access-token, thus moving it to the http header (otherwise it will be part of the request, and then it will throw an exception)
* Allow browser to send preflight OPTIONS before POST