Add PUT and DELETE to cors middleware

[neelvirdy]

Deleting API keys is currently throwing a CORS error on prod due to DELETE missing. Also adding PUT since we have API endpoints that use it, like password changing.

Note: Token hash referenced in the image is expired, will delete after this goes through.