allow either get or post