CORS requests involving OPTIONS preflight failing from Firefox and Safari

We recently got an issue report that Dropbox had stopped workin in our app (https://igv.org/app) from Firefox and Safari.   The app is a genomics visualizer, we support loading genomics data from Dropbox.   The files are huge and most requests include a "range" header.   This triggers an OPTIONs request which is failing with a 404 not-found error, and no CORS headers in the response.  It is easy to reproduce with the following javascript from Firefox or Safari.   This request works from Chrome, its possible Chrome is not sending the OPTIONs request but that's a guess.   In any event OPTIONS is a valid method and this should not fail.    I do not know when this first occured, but it definitely worked in the past.

 

In the snippet below commenting out the "range" header results in a simple GET request which returns successfully.   The "range" header spawns an OPTIONS preflight, as it should, which fails.

 

fetch('https://dl.dropboxusercontent.com/s/zx7owfskn0jk6ab/heart_slc25a3.cram?dl=0', {
    method: 'GET',
    headers: {
        range: 'bytes:1-1000'
    }
}).then(x => x.blob().then(y => console.log(y)))