disable permission checks for OPTIONS

disable permission checks for OPTIONS

a CORS request (eg as issued in chromium) needs a pre-flight OPTIONS
request on the resource, which can't use credentials yet it's the point
of CORS not to send requests from the browser anywhere without that
particular anywhere's consent.

the code behind OPTIONS does not reveal any data (not even presence of a
collection).