Cors headers when no allowed methods