only send Access-Control-Allow-Methods on option calls

When reading the CORS spec I recognized that all those additional headers should only be send on options requests. 

http://www.html5rocks.com/en/tutorials/cors/