fix: cors allows any method for known origins

Program.cs

@@ -33,7 +33,9 @@ builder.Services.AddCors(options =>
         {
             policy
             .WithOrigins(CorsOrigins.ToArray())
-            .AllowAnyHeader(); // this might not be the greatest idea
+            // this might not be the greatest idea:
+            .AllowAnyHeader()
+            .AllowAnyMethod();
         });
 });