if request has a method (e.g. OPTIONS) that can be satisfied by general code of web server then a successful response is sent;may deny access by sending a specific error message (e.g. access unauthorized) that usually forces the client browser to ask human Endbenutzer to provide required user credentials; if authentication credentials are provided