title: Pingfederate opentoken module CORS request returns 302 instead of 200
body: <p>We are using Ping Federate to protect two web servers (both IIS and both protected using the IIS integration kit, or opentoken module from Ping). One server hosts a WEB API application and the other hosts a webpage. The Web API application has CORS enabled.</p>
  
  <p>The webpage makes Ajax post requests with json data to the API server. This causes the browser to initiate a preflight options request. On the API server, the Ping module intercepts this request that does not contain credentials (the specs say that preflight options requests are not supposed to contain credentials) and returns a 302 redirect before the Web API code can handle it when it should return a 200.</p>
  
  <p>My only current guess is to make a custom module that handles options requests and install it ahead of the opentoken module. Are there any other possible/better solutions?</p>