- every OPTIONS on a CORS path: 204 with Cache-Control no-cache, private - a preflight echoes the requested method (upper-cased) and headers when * allows any, with Vary and PHP's default Content-Type, as recorded from PHP - README and the routing docs describe the answer