Client: use POST for "grant mandate" (fixes #13)