allowing POST requests on /cmd