proposal #1: We always return DAV: 1 on unauthenticated OPTIONS requests.