PUT causes CORS warning?