Add allowed methods to CORS response