check / check (push) Successful in 1m16s
net/http answered "OPTIONS *" itself, with 200, before the router, so it skipped the credential check and the security headers. The server now passes it to the router, which refuses it with 401 like any other request without the credential. A test sends it to a running server, since the handler alone never sees it. Model: opus-5-5