title: Default value for Access-Control-Allow-Methods
body: <p>I just learned about the <code>Access-Control-Allow-Methods</code> header, e.g.</p>
  
  <pre><code>Access-Control-Allow-Methods: OPTIONS, HEAD, GET
  </code></pre>
  
  <p>I have never used this header (just <code>Access-Control-Allow-Origin</code>), but I have gotten CORS to work in the past.</p>
  
  <p>Is the default to allow all methods, or have I gotten lucky with undefined behavior?</p>