A cross-origin form-encoded POST is sent without a preflight, but its response has no Acc…

A cross-origin form-encoded POST is sent without a preflight, but its response has no Access-Control-Allow-Origin. What can happen?

1. The server may perform the operation, while the browser prevents the calling script from reading the response
2. The browser must cancel the POST before any bytes reach the server
3. The browser automatically retries the POST as an OPTIONS request