I think you'd probably need to inherit from [CORSViewSet](https://github.com/mozilla/zamboni/blob/c2cc24140175da3653b5a524d113e5734b8e1dcb/mkt/api/base.py#L510) for `cors_allowed_methods` to be picked up, right?