cors enables all request types by default