changes the allow method to methods for cors
whoops, forgot to increment version