adding correct headers in CORS reponses, plus passing test

PUT and DELETE requests were not working with CORS. They are now.