Firebug shows that although the drupal settings had "http://www.example.com/";, and I was visiting "http://www.example.com/"; the "OPTIONS" were sent to "http://example.com/";. Redirected "www.example.com" to "example.com", changed the settings to "example.com" and all was well.

I should find the bug and file a report.