fixed: CORS only accept GET requests