CORSMiddleware does not respect methods defined for route

[slavugan]

For preflight request CORSMiddleware adds all available methods, GET, POST, PUT etc... in the Access-Control-Allow-Methods header , but when only GET method is defined for a route, there should not be other methods in Access-Control-Allow-Methods header as they are actually not allowed.
There are several issues that can be related to this one as matched router is not known at this point:
#1286
#685