This list of methods is the list where Lock-token _must_ be specified for. In the case of other methods, we must still validate the contents of the If: header. A client can in theory do a GET operation on a random resource, but only let it succeed if a lock-token on a completely unrelated resource exists.

I added some comments to clarify this though.