Fix CORS allowed methods