Authenticated media requires authentication even on OPTIONS method

[matrixbot]

This issue was originally created by @arenekosreal at matrix-org/dendrite#3424.

Background information

• Dendrite version or git SHA: 0.13.8
• SQLite3 or Postgres?: postgres
• Running in Docker?: no
• go version: 1.23.1
• Client used (if applicable): Cinny web 4.2.1 on ungoogled-chromium 128.0.6613.113

Description

• What is the problem: Cinny fails to load all media through MSC3916 endpoints.
• Who is affected: Me
• How is this bug manifesting: In chromium's developer tools, all media requests through MSC3916 endpoints failed to perform correctly.
• When did this first appear: after Cinny upgraded to 4.2.1 and dendrite upgraded to 0.13.8

Steps to reproduce

• Ensure Cinny web version is 4.2.1 and dendrite version is 0.13.8
• Simply login and check media like avatars or images in chat.
• You will find those media failed to load.
• Check developer tools in browser for the requests to the media
• You will find GET request failed with net::ERR_FAILED, fetch request failed with CORS error, preflight request failed with 401 Unauthorized

Screenshots of developer tools

Notes

According to this stackoverflow answer, authentication in preflight requests is not possible, so this may be the cause.