I forgot to put them back on method level, good catch. The reason I removed it from the class level is that the OPTIONS request comes in as unauthorized.