Experiment: only allow GET/POST/HEAD