resources: reject non-HEAD non-GET requests