Sometimes your browser sends an extra OPTIONS request before your real request. That's a CORS preflight — a security check.
CORS (Cross-Origin Resource Sharing) protects you from malicious sites. By default, JavaScript on one domain can't access APIs on another domain — unless the API explicitly allows it.