CORS preflight OPTIONS request should not require client cert auth

[alechenninger]

Per spec at http://dvcs.w3.org/hg/cors/raw-file/tip/Overview.html#preflight-request the preflight request never includes cookies. Specifically, the spec says:

Exclude user credentials.

and that links to http://dvcs.w3.org/hg/cors/raw-file/tip/Overview.html#user-credentials which says:

The term user credentials for the purposes of this specification means cookies, HTTP authentication, and client-side SSL certificates.

Source: http://stackoverflow.com/a/10135361

This is causing issues with the data management application which relies on CORS: lightblue-platform/lightblue-applications#121