I've added OPTIONS and HEAD. This list would be wrong for some endpoints like /node/id# on a deployment like api.osm.org where we'd want DELETE and PUT going to the rails port.

The alternative to the rather hackish \r\n is special casing 405 errors in respond_error which prints the errors, or never throwing an error in the first place for 405 errors. Which would be better?