fixed access-control-allow-methods header call