Added verb check to CORS host checks