Explicitly list allowed methods for CORS