Safari doesn't seem to send an OPTIONS request just because custom headers are present.
If we make a request to `/*` and set `Access-Control-Max-Age`, Chrome seems to respect it for requests to various endpoints with various query params
Firefox doesn't seem to respect it, but also maybe Firefox usage is low enough that we don't care?