Access-Control-Allow-Methods should be GET,HEAD

[feross]

In the webtorrent server, the Access-Control-Allow-Methods header should not set it's value to GET,HEAD,PUT,PATCH,POST,DELETE since only GET,HEAD are actually handled. Any other request type is rejected by the server with an "invalid method" error.

Let's pare down the list for defense-in-depth reasons. No reason to let cross-origin domains even send these requests in the first place.

@diracdeltas

[diracdeltas]

++

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[feross]

Just sent a PR for this: #1383