OPTIONS, GET, HEAD, POST, PUT, DELETE

HTTP allows any methods so I have no idea why I should only allow these. We could really go all out.