Allowed CORS for POST, PUT, DELETE