title: Azure API Management - CORS issue
body: <p>Providing the following CORS policy at the topmost scope of the Azure API Management:</p>
  
  <pre><code>&lt;policies&gt;
          &lt;inbound&gt;
              &lt;cors&gt;
                  &lt;allowed-origins&gt;
                      &lt;origin&gt;*&lt;/origin&gt;
                  &lt;/allowed-origins&gt;
                  &lt;allowed-methods&gt;
                      &lt;method&gt;*&lt;/method&gt;
                  &lt;/allowed-methods&gt;
                  &lt;allowed-headers&gt;
                      &lt;header&gt;*&lt;/header&gt;
                  &lt;/allowed-headers&gt;
                  &lt;expose-headers&gt;
                      &lt;header&gt;*&lt;/header&gt;
                  &lt;/expose-headers&gt;
              &lt;/cors&gt;
          &lt;/inbound&gt;
          &lt;backend&gt;
              &lt;forward-request /&gt;
          &lt;/backend&gt;
          &lt;outbound /&gt;
      &lt;/policies&gt;
  </code></pre>
  
  <p>When using:</p>
  
  <pre><code>    var xhr = new XMLHttpRequest();
      xhr.open('GET', 'https://mydomain.azure-api.net/calc/add?a=5&amp;b=5');                 
      xhr.send();
  </code></pre>
  
  <p>Raw request:</p>
  
  <pre><code>    GET https://mydomain.azure-api.net/calc/add?a=5&amp;b=5 HTTP/1.1
      Host: mydomain.azure-api.net
      Connection: keep-alive
      Origin: https://any.com
      User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36
      Accept: */*
      Referer: https://any.com/
      Accept-Encoding: gzip, deflate, sdch, br
      Accept-Language: en-US,en;q=0.8,de;q=0.6,pl;q=0.4
  </code></pre>
  
  <p>I am receiving error message:</p>
  
  <pre><code>XMLHttpRequest cannot load https://mydomain.azure-api.net/calc/add?a=5&amp;b=5. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://any.com' is therefore not allowed access. The response had HTTP status code 401.
  </code></pre>
  
  <p>Raw response:</p>
  
  <pre><code>    HTTP/1.1 401 Access Denied
      Content-Length: 152
      Content-Type: application/json
      WWW-Authenticate: AzureApiManagementKey realm="https://mydomain.azure-api.net/calc",name="Ocp-Apim-Subscription-Key",type="header"
      Date: Fri, 04 Nov 2016 09:31:15 GMT
  
      { "statusCode": 401, "message": "Access denied due to missing subscription key. Make sure to include subscription key when making requests to an API." }
  </code></pre>
  
  <p>As soon as I use correct api key:</p>
  
  <pre><code>    var xhr = new XMLHttpRequest();
      xhr.open('GET', 'https://mydomain.azure-api.net/calc/add?a=5&amp;b=5');     
      xhr.setRequestHeader('Ocp-Apim-Subscription-Key', '**********************');
      xhr.send();
  </code></pre>
  
  <p>Raw request:</p>
  
  <pre><code>    GET https://mydomain.azure-api.net/calc/add?a=5&amp;b=5 HTTP/1.1
      Host: mydomain.azure-api.net
      Connection: keep-alive
      Origin: https://any.com
      User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36
      Ocp-Apim-Subscription-Key: **********************
      Accept: */*
      Referer: https://any.com/
      Accept-Encoding: gzip, deflate, sdch, br
      Accept-Language: en-US,en;q=0.8,de;q=0.6,pl;q=0.4
  </code></pre>
  
  <p>I am receiving success message.</p>
  
  <p>Raw response:</p>
  
  <pre><code>    HTTP/1.1 200 OK
      Cache-Control: no-cache
      Pragma: no-cache
      Content-Length: 123
      Content-Type: application/xml; charset=utf-8
      Expires: -1
      X-AspNet-Version: 4.0.30319
      X-Powered-By: ASP.NET
      Access-Control-Allow-Origin: *
      Access-Control-Expose-Headers: Content-Length,Date,Server,X-AspNet-Version,X-Powered-By
      Date: Fri, 04 Nov 2016 09:34:44 GMT
  
      &lt;result&gt;&lt;value&gt;10&lt;/value&gt;&lt;broughtToYouBy&gt;Azure API Management - http://azure.microsoft.com/apim/ &lt;/broughtToYouBy&gt;&lt;/result&gt;
  </code></pre>
  
  <p>Question:</p>
  
  <p>It does look to me like CORS issue happens only when incorrect/no API key is provided, is this expected behaviour from Azure API Management?</p>