Oh, sorry, I thought you meant the route constraints — yes, `Access-Control-Request-Method` should be POST.