title: barryvdh/laravel-cors configs not working in Laravel 5.6; Ignores 'allowedMethods'
body: <p>I have installed the <a href="https://github.com/barryvdh/laravel-cors" rel="nofollow noreferrer">barryvdh/laravel-cors</a> package in my Laravel 5.6 app, and added the relevant lines to my middeware groups in <code>app\Http\Kernel.php</code>, and published the config file as per the instructions.</p>
  
  <p>I have disabled CSRF checks for my api routes in <code>VerifyCsrfToken.php</code> with</p>
  
  <pre><code>protected $except = [
      'api'
  ];
  </code></pre>
  
  <p>I have set the config file as below:</p>
  
  <pre><code>'supportsCredentials' =&gt; false,
  'allowedOrigins' =&gt; ['https://developer.mozilla.org'],
  'allowedHeaders' =&gt; ['Content-Type', 'X-Requested-With'],
  'allowedMethods' =&gt; ['GET', 'POST', 'PUT',  'DELETE']
  'exposedHeaders' =&gt; [],
  'maxAge' =&gt; 0,
  </code></pre>
  
  <p>...and I have have run a test <code>POST</code> request in Postman using "Origin: <a href="https://developer.mozilla.org" rel="nofollow noreferrer">https://developer.mozilla.org</a>" in the header.</p>
  
  <p>It's working- fine. And if I change that Origin key to anything other than <a href="https://developer.mozilla.org" rel="nofollow noreferrer">https://developer.mozilla.org</a> it throws the "Not allowed in CORS policy." error. Which is what I'd expect, as per the config- fine.</p>
  
  <p>BUT if I change the config line to </p>
  
  <pre><code>'allowedMethods' =&gt; ['GET']
  </code></pre>
  
  <p>(ie. allow only GET requests), and run the <em>same</em> POST request in Postman... it still works.</p>
  
  <p>Why? Why doesn't it respect the limitation imposed in the config for allowedMethods?</p>