rest: HTTP OPTIONS calls are fetching resources.

[smyrman]

It seams like an HTTP OPTIONS call will fetch resources if you do an OPTIONS call against a nested resource. E.g.:

http OPTIONS :8080/parents/123/children

Will result in a Find call against resource parents for items with ID 123. This does not seam like the right behavior.

[smyrman]

One question is if the Handler for index should handle options requests at all, or if we should have a completely different options handler. This would allow for OPTIONS requests to bypass authentication for instance.

We found a good order of middelware to be:

1. Authenticate user token and set user in context if succesfull. Call next handler either way.
2. Access log middleware
3. CORS handler, pass through OPTIONS requests.
4. OPTION handler for a resource.Index
5. Require login barrier -- only pass through if authenticated.
6. API handler for the same resource.Index