add PATCH to allowed CORS methods in thread api