Fixed allowed methods for retrieving token with cors