For this validation in place, does it mean that request from browser doesn't send custom headers during OPTIONS request? What I'm thinking is that APIgee needs to validate the API Key passed from the options request.