Add CORS support

fixes #74
ack, sorry about that. 

`delete` is also used, but no reason for that to be exposed over CORS.


removed