Ensure CORS sends DELETE as an option