fix GET bucket?location
add some TODO and 'unsupoort'
fix allowed method in CORS