Add PATCH and OPTIONS to the list of allowed cors methods

This merely adds PATCH and OPTIONS to the "Access-Control-Allow-Methods" header on CORs preflight requests. It was discussed in #235 but no action was ever taken.