DELETE allowed (CORS decorator-call needs refactoring)