Form strict method check

Marked as API changes, but in fact they're very small ones (its unlikely that many devs rely on GET on Security/login, and the strict checking is opt in) - hence I think this is still feasible to get into 3.1