add PATCH to default cors methods, closes #1475

I agree this should be in the defaults