title: GET and POST appear to be allowed regardless specification in the builder's WithMethods(..)
body: <p>In my <em>StartUp.cs</em> I have the following setup for CORS.</p>
  
  <pre><code>services.AddCors(_ =&gt; _.AddPolicy("LocalDev", __ =&gt; __
    .AllowAnyOrigin()
    .AllowAnyHeader()
    .WithMethods("GET", "POST", "PUT", "DELETE")
  ));
  </code></pre>
  
  <p>It works as expected. However, I noticed that removing <em>GET</em> and <em>POST</em> doesn't seems to affect the funtionality. Removing <em>PUT</em> or <em>DELETE</em> has effect, though. I'm confused by this.</p>
  
  <p>Is it the case that the methods for getting and posting enjoy a special status while the others are required to be explicitly provided? I haven't found any references on that in <a href="https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.cors.infrastructure.corspolicybuilder.withmethods?view=aspnetcore-3.1#Microsoft_AspNetCore_Cors_Infrastructure_CorsPolicyBuilder_WithMethods_System_String___" rel="nofollow noreferrer">MSDN for the method</a>.</p>