Browser fetches to PATCH /api/mods/:slug/edit were rejected with
'Method PATCH is not allowed by Access-Control-Allow-Methods in
preflight response'. The CORS allowMethods list omitted PATCH, so the
new owner-edit endpoints from the publishing flow were unreachable
from ravenswatch.ovilli.de.