x-amzn-ErrorType:UnauthorizedException from Options request

Hi,
I have a proxy API, created with Serverless Express integration, that uses a custom Authorizer and I have been struggling with OPTIONS method with no success.
This is an example of request / response:

GENERAL
Request URL:https://ol12XXXX.execute-api.eu-west-1.amazonaws.com/prod/api/users/107
Request Method:OPTIONS
Status Code:401 Unauthorized
Remote Address:54.240.162.120:443

RESPONSE
Connection:keep-alive
Content-Length:26
Content-Type:application/json
Date:Tue, 24 Jan 2017 14:38:10 GMT
Via:1.1 9aac77db976fd4f008caa822737485da.cloudfront.net (CloudFront)
X-Amz-Cf-Id:jKCgEzblaYOJlfk4MgvBkEgWoyG1VLeyhY6PzDsRst9OHuQ7wS-r7Q==
x-amzn-ErrorType:UnauthorizedException
x-amzn-RequestId:ba9a6bfd-e242-11e6-9193-773bc0dbb837
X-Cache:Error from cloudfront

REQUEST HEADERS
Accept:*/*
Accept-Encoding:gzip, deflate, sdch, br
Accept-Language:it
Access-Control-Request-Headers:authorization
Access-Control-Request-Method:GET
Cache-Control:no-cache
Connection:keep-alive
Host:ol12j12b9k.execute-api.eu-west-1.amazonaws.com
Origin:http://localhost:8880
Pragma:no-cache
Referer:http://localhost:8880/
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36

The request by itself works, e.g. tested from Postman and CORS seems to be corrected enabled: access-control-allow-origin is set to * in the response header.

As per other messages, it looks like API Gateway is masking the actual error.
I tried to enable / disable custom authorizer in the OPTIONS method, but the result is the same.

I have no idea what to do next: can someone please help?
Thanks