Added PATCH to CORS headers