fix(handlers): add Access-Control-Allow-Methods to cors

This is needed to have CORs work properly. Fixes #252