I am using Cloud IAP to protect APIs (on Google App Engine), and I'd like to access them from a JavaScript app in the browser.
The problem is: the browser tries to send a preflight OPTIONS request, which is blocked by IAP. As I cannot attach any Authorization header to OPTIONS, what is the solution?