respond "method not allowed"