TMSS-876: include Access-Control-Allow-Methods in response headers to hint to the frontend what the user is permitted to do
Closes TMSS-876