Use common responseSupport which adds all expected headers and supports
anonymous access, so OPTIONS can be simplified.