Remove OPTIONS from Access-Control-Allow-Methods

Is not necessary for the cross site request to work