forms: allow POST method