Fix TreatsController#create & CORS; allow deleting