nelmio_cors:
  defaults:
    allow_credentials: true
    allow_origin: ['*']
    allow_headers: ['*']
    allow_methods: ['POST', 'PUT', 'GET', 'DELETE']
    expose_headers: ['*']
    max_age: 3600
  paths:
    '^/': ~
nelmio_cors:
  defaults:
    allow_credentials: true
    allow_origin: ['*']
    allow_headers: ['*']
    allow_methods: ['POST', 'PUT', 'GET', 'DELETE', 'PATCH']
    expose_headers: ['*']
    max_age: 3600
  paths:
    '^/': ~
Allow PATCH as valid method for CORS
Allow PATCH as valid method for CORS

When a browser makes a request to a different domain it first does a "preflight" check to ensure that type of request is allowed. Since we support PATCH now for JSON api this needed be be whitelisted here.
