when processing an OPTIONS request, set the Access-Control-Allow-Methods...

... response header appropriately to reflect the supported methods.

added CORS support for allowed origins