Make sure only OAuth2 is allowed to POST/PUT/DELETE