CORS allow methods
Merged