CORS pre-flight with not allowed method