allow marking notes/thread as read (bug 897265)
add PATCH to allowed CORS methods in thread api