Limit the case API to GET requests

There was a 500 based on a POST with who-knows-what in it. Either way, I don't think this resource could ever have worked except for GET requests.