Return 405 when using non-POST on command URL. (fixes #8)
Use 307 for redirects, so POST requests can still go via auth step