CORS question

Hey guys,

Co-workers of mine were trying to understand the treat model of CORS, and I
was having trouble articulating some of the particular risks that the spec
attempts to avoid.  Why does the OPTIONS pre-flight request never carry
credentials?

Thanks,
Brandon