Allow CORS DELETE