DELETE is not allowed by Access-Control-Allow-Methods

The value of Access-Control-Allow-Methods needs to be a comma separated list, not a space separated one.

From MDN:

Access-Control-Allow-Methods: <method>[, <method>]*