Allow DELETE for CORS