A PEN test discovered that a OPTIONS verb returned data from my (ASP.NET 4/MVC 5) server. Based on a number of sources, in the web.config, I\'ve configured IIS to block this ver
