Return a 405 for POST requests to /search

They're currently falling though and hitting the publication routes
which then blow up when calling content_api without a `q` param.