allow methods in cors