adding 'delete' as an allowed CORs method