@xiangli-cmu @philips CORS uses the `OPTIONS` method in the preflight request to check if CORS is available. It's a standard HTTP 1.1 method ([RFC 2616](http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html)).

We don't currently use `OPTIONS` on our API so I don't think we need it in the `Access-Control-Allow-Methods` header. It doesn't hurt anything either though.