in the end it turned out to do unauthenticated OPTIONS request to the calendar url