title: The "Authorization" header is not sent in OPTIONS call by the browser
body: <p>I have a very simple HTTP call:</p>
  
  <pre><code>fetch('http://127.0.0.1:5500/v1/homes/', {
    method: "GET", 
    mode: "cors", 
    credentials: "same-origin", 
    headers: {
       Authorization: "TEST"
    }})
    .then(function(response) {
      console.log(response);
    });
  </code></pre>
  
  <p>But when I look into the "Networks" tab of Google Chrome DevTools, the OPTIONS request does not have the "Authorization" header in it. This causes the server to replies with 401 Unauthorized.</p>
  
  <p>The browser's curl equivalent of the request:</p>
  
  <pre><code>curl 'http://127.0.0.1:5500/v1/homes/' \
  -X OPTIONS -H 'Access-Control-Request-Method: GET' \
  -H 'Origin: http://localhost:8100'
  -H 'Referer: http://localhost:8100/'
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'
  -H 'Access-Control-Request-Headers: authorization'
  --compressed
  </code></pre>
  
  <p>Am I doing something wrong in the client side or is it quite common that browsers do not send the Authorization header in OPTIONS request, and therefore, I need to change the server in a way to response to OPTIONS call without requiring Authorization header?</p>