fixed CORS also for methods other than GET