Do not interfere with CORS preflight requests

[cbandy]

Something somewhat standard does use OPTIONS!

• http://www.w3.org/TR/cors/
• http://en.wikipedia.org/wiki/Cross-origin_resource_sharing
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

We should let the app respond to these requests directly.