add PATCH to cors headers
don't try to automatically decode models