Allow all methods in CORS