FEATURE: Updated CORS config to explicitly specifyhttp methods

See: https://stackoverflow.com/questions/20478312/default-value-for-access-control-allow-methods 

In particular we now explicitly allow DELETE and PUT which is inconsistently allowed depending on browser

config/initializers/008-rack-cors.rb

@@ -41,6 +41,7 @@ def self.apply_headers(cors_origins, env, headers)
       headers['Access-Control-Allow-Origin'] = origin || cors_origins[0]
       headers['Access-Control-Allow-Headers'] = 'Content-Type, X-Requested-With, X-CSRF-Token, Discourse-Visible, User-Api-Key, User-Api-Client-Id'
       headers['Access-Control-Allow-Credentials'] = 'true'
+      headers['Access-Control-Allow-Methods'] = 'POST, PUT, GET, OPTIONS, DELETE'
     end
 
     headers