add allow method to wrap-cors