Allow PATCH via CORS on collections

inb4wkend