Ensure that you can only sign in/out with POST requests