This is not a final official fix but I'd like to create this PR to raise a bug that needs a bigger solution.

The implemented fix submitted is what we're using as a temporary fix until you guys figure this out :)

Here's the simplified version of the issue:

We want to support PATCH for vmboxes.
We created our custom cb_grid_vmboxes module that supports PATCH
For cb_grid_vmboxes.allow_methods we want to return the verbs we support
Without flattering the list, we don't get PATCH as supported (some other weird list of allow_methods verbs seems to be used -- we haven't looked into it)

Main reason solution needs help:
With flattening the list, crossbar_bindings will still attemp to call PATCH for cb_vmboxes which is undefined.  This generates an error in the logs, but since it's done in another process - yay for crossbar_bindings - this doesn't "break" anything.
Removed changes from api_resource and instead made the recommended change to api_util:allow_methods/4.
This seems to work well and makes sense.
Merge pull request #671 from aberke/crossbar-allow_methods-fix

Crossbar allow methods fix