CORS-preflight fetch

Thanks to @youennf in #733 I noticed that CORS-preflight fetches currently don't set the CORS flag when invoking HTTP-network-or-cache fetch. While this does not impact them setting the `Origin` header (due to using the `OPTIONS` method), it does impact it processing a 401, which it should not be doing.