TroyGoode/node-cors — pull request #1 by damienklinnert (2013-03-12 15:25:42+00:00)
Title: only send Access-Control-Allow-Methods on option calls

When reading the CORS spec I recognized that all those additional headers should only be send on options requests.

http://www.html5rocks.com/en/tutorials/cors/