X-CSRFToken - maly problem.

Czesc pisalem ostatni post z $http w angularze i corsem, ale to jest teraz temat na osobny post. Otoz wysylam moj token X-CSRFToken co kazdy request w angularze za pomoca authinterceptor. Teraz nie bardzo wiem jak dobrze to obsluzyc w backendzie, bo znow pojawia sie problem z kodem 405. A oto sposoby jakie probowalem.

 
    $response->headers->set('Access-Control-Allow-Origin', 'example.com');
    $response->headers->set('Access-Control-Allow-Methods', 'POST, GET, OPTIONS, DELETE, PUT');
    $response->headers->set('Access-Control-Allow-Methods', 'POST, GET, OPTIONS, DELETE, PUT');
$response->headers->set('Access-Control-Allow-Headers', 'Content-Type,accept,x-csrftoken');

 
//interceptor
          return {
            request: function (config) {
              config.headers = config.headers || {};
              if($cookies.get('csrftoken'))
               config.headers['X-CSRFToken'] = $cookies.get('csrftoken');
                  
              return config;
            }

Pytanie - czy jest to poprawny sposob rozwiazania tego problemu ?

  if($_SERVER['REQUEST_METHOD'] == 'OPTIONS')
  {
    header('Access-Control-Allow-Origin: example.com');
   header('Access-Control-Allow-Headers: X-Requested-With,Origin, Accept, Accept-Version, Content-Length, Content-Type,X-CSRFToken');
    header("HTTP/1.1 200 OK");
    die();
  }