<NME> AUTHORS
<BEF> ADDFILE
<MSG> Ignore authentication headers for OPTIONS

We need to ignore authentication headers for OPTIONS to avoid
unwanted interactions with CORS.
Chrome and Firefox issue a preflight OPTIONS request to check
Access-Control-* headers, and will fail if it returns 401.

https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Overview

<DFF> @@ -0,0 +1,2 @@
+Miguel Grinberg <miguelgrinberg50@gmail.com>
+Henrique Carvalho Alves <hcarvalhoalves@gmail.com>

Ignore authentication headers for OPTIONS