use GET for CORS requests to prevent preflight overhead

POST requests will probably be re-introduced later for requests that
are too large to fit in a single URL