Add cross-origin for webdav even when not authorized (otherwise remote app cannot get info to go to authorization page)
+ support OPTIONS for preflighted requests (see doc: https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Preflighted_requests ).