Add PATCH and HEAD to the Access-Control-Allow-Methods

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>

app-config.yaml

@@ -39,7 +39,7 @@ backend:
     store: memory
   cors:
     origin: http://localhost:3000
-    methods: [GET, POST, PUT, DELETE]
+    methods: [GET, HEAD, PATCH, POST, PUT, DELETE]
     credentials: true
   csp:
     connect-src: ["'self'", 'http:', 'https:']

packages/create-app/templates/default-app/app-config.yaml.hbs

@@ -24,7 +24,7 @@ backend:
     # Default Helmet Content-Security-Policy values can be removed by setting the key to false
   cors:
     origin: http://localhost:3000
-    methods: [GET, POST, PUT, DELETE]
+    methods: [GET, HEAD, PATCH, POST, PUT, DELETE]
     credentials: true
   # This is for local developement only, it is not recommended to use this in production
   # The production database configuration is stored in app-config.production.yaml