added 'Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS'