issue #19151: safeguarded routes against naked GETs