only send Access-Control-Allow-Methods on option calls
Merge pull request #1 from damienklinnert/master

only send Access-Control-Allow-Methods on option calls