Start to make potentially expensive operations POST-only.

This will help prevent triggering a refresh accidentally, such as
when restoring a browser session after a crash.