title: Backbone model CORS fetch not being sent
body: <p>I'm trying to use a model.fetch() from another domain, but I seem to have stumbled upon a wall. It seems that I can do a cross-domain request OR set custom headers (it doesn't matter WHICH one), not both. Unfortunately, I need both, since the API I'm trying to fetch from uses Basic Auth.</p>
  
  <p>Here's things in a nutshell:</p>
  
  <pre><code>var Model = Backbone.Model.extend({
      url: function() {
          return a_cross_domain_url;
      },
      initialize: function() {
          this.fetch();
      }
  });
  
  Backbone.sync = _.wrap(Backbone.sync, function(sync, method, model, options) {
      if (!options.xhrFields) {
          options.xhrFields = {withCredentials:true};
      }
  
      options.headers = options.headers || {};
  
      // credentials is a string that looks like 'Basic d2Vwb3c6McriNzk3YZgvZTNkMTkzOGE4MTk3NjMwMDkzNmMwZGI='
      options.headers['Authorization'] = credentials;
  
      sync(method, model, options);
  });
  
  var m = new Model();
  </code></pre>
  
  <p>I'm abstracting a lot of code, but I think this is the relevant info. What matters is that the end request looks like this:</p>
  
  <p><img src="https://i.stack.imgur.com/7g0CC.png" alt="Firebug&#39;s log of end CORS request"></p>
  
  <p>As far as I understand, it's all I need for this to work. It's funny, because the $.ajax.beforeSend function does get fired, but there's no log of the actual GET ever firing at all (server receives nothing). It seems to be cancelled before it's even called. The error callback does fire, and prints:</p>
  
  <pre><code>SyntaxError: JSON.parse: unexpected end of data
  </code></pre>
  
  <p>The JSON.parse may be because I'm expecting JSON from the server when an error arrives to display them to the end user on my app, however, besides that message I'm not getting any clues as to what is happening or why the request is being cancelled.</p>
  
  <p>As a last note, if I remove the header from the request (on the js above), the GET gets executed, but refused by the server since there's no auth.</p>
  
  <p>Any idea of what's going on would be greatly appreciated.</p>