404 for web.api cors OPTIONS

In case anyone else has the same problem, this issue was due to the fact that we were using Microsoft's excellent UrlScan in IIS.

UrlScan has an AllowVerbs section and a DenyVerbs section. Ensure that the options verb is allowed.