HTTP 405 response must include an Allow header

When an HTTPError(405) is raised, either manually or automatically because of not implementing a handler, Tornado does not set the officially required Allow header. Worse, if I set it myself, it is erased by RequestHandler.send_error. Bluntly said, it means that Tornado does not follow HTTP standards.

When addressing this, please consider adding a possibility to override the list of supported methods, rather than looking only at the present handlers; I built my own mechanism to limit their usage at certain URLs:

class BaseHandler(RequestHandler):
    def initialize(self, *args, **kwargs):
        self.allowed_methods = kwargs.get('allowed_methods', type(self).SUPPORTED_METHODS)

    def prepare(self):
        if self.request.method not in self.allowed_methods: raise HTTPError(405)

Start by tracing HTTPError(405) through RequestHandler.send_error and the automatic path for requests without a handler. Check how the Allow header is currently generated or cleared, including the issue's proposed allowed_methods override. Done means a 405 response preserves or sets an Allow header that reflects the supported methods, including custom restrictions.