Add allow methods to cors for web access