Make HTTP verbs explicit in routes

In several cases we were using `match` but not offering POST/PUT etc. variants of a controller, which means Rails responds to the request anyway.

This is now explicit using `get`. I've also changed anything using `via` to use `get`, except for the ones that were using `via: :post`.

There should be no change in functionality except methods that used to erroneously work now won't.