miguelgrinberg/Flask-HTTPAuth — pull request #8 by hcarvalhoalves (2014-04-07 21:00:33+00:00)
Title: Ignore authentication headers for OPTIONS

We need to ignore authentication headers for OPTIONS to avoid unwanted interactions with CORS.
Chrome and Firefox issue a preflight OPTIONS request to check Access-Control-* headers, and will fail if it returns 401.

More at https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Overview