CORS pre-flight workaround is giving us 400 errors

In https://www.dropbox.com/developers/documentation/http/documentation in the section called "Browser-based JavaScript and CORS pre-flight requests" a method is given to avoid a preflight request. We've been using this successfully for half a year. Today, we've noticed a roughly 50% failure rate for API calls using this method with an error "Error in call to API function "files/list_folder": Unexpected URL params: "authorization"". The other 50% work just fine as usual. In both cases, they are the same calls - one call to list_folder will fail and the next will succeed. An example of a failure has

x-dropbox-request-id: 478d61ccd84d41d3b0c061f2c212ff9a

 

We have found that reverting to use the version of the API that does use a preflight works just fine, so we have a (slightly slower) workaround.

 

Any insight would be appreciated.

 

Thanks!