HTTP 405 (Method Not Allowed) should include an Allow header

Tiny change: Based on [the spec](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.6), HTTP 405 responses should include an `Allow` header containing all the allowed methods for that path. Something similar is already implemented for `OPTIONS` requests, so I applied the same concept to 405 responses.