Replace PATCH with fakes using POST and Access-Control-Allow-Methods header.

This gets around the fact that some firewalls seem to restrict PATCH.