only GET and POST methods permitted