CORS preflight request sent for "simple requests"

[rexxars]

Describe the bug
"Simple requests" should not trigger a preflight request, instead they should reject if the server responds without the necessary access-control-allow-origin header.

To Reproduce
Steps to reproduce the behavior:

1. Send a GET request with no custom headers from http://localhost:1234 to http://localhost:9876
2. Observe that there is an OPTIONS request sent first (the CORS preflight check), instead of simply performing the request

Expected behavior
Requests that conform to the "simple request" pattern shouldn't trigger a preflight