According to the W3C spec, user credentials should never be sent with preflight (OPTIONS) requests. This means that the server should respond to an OPTIONS request even if the eventual request (GET, POST, ...) is protected by Basic or Digest authentication and should not respond with a 401.

http://www.w3.org/TR/cors/#preflight-request