requests with invalid credentials do not return CORS headers

[individual-it]

Steps to reproduce

1. set http://owncloud.org CORS domain
2. curl -u admin:invalidpwd http://localhost/owncloud-core/remote.php/dav -X PROPFIND -v -H "Origin: http://owncloud.org"
   OR
   curl -u admin:invalidpwd http://localhost/owncloud-core/ocs/v1.php/cloud/users -H "Origin: http://owncloud.org" -v

Expected behaviour

CORS headers returned

Actual behaviour

no CORS headers

Server configuration

Operating system:
Ubuntu 18.04
Web server:
Apache2
Database:
SQLite
PHP version:
7.2
ownCloud version: (see ownCloud admin page)
11.0.0
Updated from an older ownCloud or fresh install:
fresh
Where did you install ownCloud from:
git

Logs

ownCloud log (data/owncloud.log)

{"reqId":"ZdlyEedmyIPbH9ZuuMrd","level":2,"time":"2019-03-05T06:23:05+00:00","remoteAddr":"127.0.0.1","user":"--","app":"core","method":"GET","url":"\/owncloud-core\/ocs\/v1.php\/cloud\/users","message":"Login failed: 'admin' (Remote IP: '127.0.0.1')"}

[ownclouders]

GitMate.io thinks the contributor most likely able to help you is @ownclouders.

Possibly related issues are #34664 (ocs config endpoint does not return CORS headers), #33909 (Feature/allow cors header x request), #3391 (Ampache XML server returns invalid url & incomplete headers), #257 (OPTIONS request on WebDAV url doesn't respond with the Dav header), and #31211 (Oauth2 token request behaves incorrectly with invalid token).

[DeepDiver1975]

please test this with #34622

[individual-it]

@DeepDiver1975 same results