title: Should I simulate a cors OPTIONS request in sinon.js or how do I test cross domain ajax requests?
body: <p>I'm creating unit tests for a javascript/jquery libarary I'm working on. I need to make a lot of cross-domain Ajax requests and am trying to fiddle my way through <a href="http://sinonjs.org/" rel="nofollow">Sinon.js</a> to try and simulate the following scenario:</p>
  
  <ul>
  <li>I do an AJAX "PUT" cross-domain request to <code>x-domain-abc.com/somestorage</code></li>
  <li>I'm including custom headers for authentification</li>
  <li>This will trigger a preflight OPTIONS request</li>
  <li>The request should be caught by the fakeServer and responded with some custom headers (the ones I'm hoping my provider to add ;-)</li>
  <li>Afterwards the actual "PUT" is done, also caught by the fakeServer and responded accordingly.</li>
  </ul>
  
  <p>My request looks like this:</p>
  
  <pre><code>$.ajax({
    url: url + '?_=' + Date.now(),
    type: 'PUT',
    data: document,
    async: true,
    crossdomain: true,
    headers : {
    Authorization: 'Basic ' + Base64.encode(
      priv.user + ':' + priv.pass
      )
    },
    success: function () {
        // do sth
    },
    error: function () {
        // do sth else
    }
  });
  </code></pre>
  
  <p>In my test module I'm currently doing this:</p>
  
  <pre><code>test ("Put", function(){
    var o = generateTools(this);
    // lib invocation
    o.jio = JIO.newJio({
      "type": "dav",
      "username": "davput",
      "password": "checkpwd",
      "url": "https://ca-davstorage:8080"
    });
  
    // put non empty document
    o.addFakeServerResponse("PUT", "put1", 201, "HTML RESPONSE");
    o.spy (o, "value", {"ok": true, "id": "put1"},
           "Create = PUT non empty document");
    // the JSON "document" that should be stored
    o.jio.put({"_id": "put1", "title": "myPut1"}, o.f);
    o.clock.tick(5000);
    o.server.respond();
    o.jio.stop();
  });
  </code></pre>
  
  <p><code>O</code> includes:</p>
  
  <pre><code>generateTools = function (sinon) {
    var o = {};
    o.t = sinon;
    o.server = o.t.sandbox.useFakeServer();
    o.clock = o.t.sandbox.useFakeTimers();
    o.clock.tick(base_tick);
    o.spy = basicSpyFunction;
    o.tick = basicTickFunction;
    ...
    o.addFakeServerResponse = function (method, path, status, response) {
      var url = new RegExp('https:\\/\\/ca-davstorage:8080\\/' + path +
                      '(\\?.*|$)');
      o.server.respondWith(method, url,
        [status, { "Content-Type": 'application/xml' }, response]
      );
    }
    return o;
  },
  </code></pre>
  
  <p><strong>Question:</strong><br>
  Does it make sense to test for OPTIONS/preflight at all, as it is something handled internally by the browser, which I cannot access or influence?</p>
  
  <p>If not, what should I test on a CORS request? </p>