Give some 405s instead of 500s for unimplemented methods

This will prevent 500 errors from hitting e.g. the api/<version>/form/ list endpoint. For good measure I added bits to the other APIs to make them clearly read-only.