PUT method allowed in the CORS filter