Simple CORS request with not allowed method