Make HTTP verbs explicit in routes

In several cases we were using `match` but not offering POST/PUT
etc. variants of a controller, which means Rails responds to the request
anyway.

This is now explicit using `get`. I've also changed anything using `via`
to use `get`, except for the ones that were using `via: :post`.