I don't _think_ it would hurt anything to have sandstorm unauthenticated OPTIONS send Dav: 1 header always, but I'd be willing to test it.