OPTIONS accepted, CORS enabled for any 404
DELETE allowed (CORS decorator-call needs refactoring)