Right now, a lot of these views are basically convenience functions for manual testing purposes and are hidden behind the DEBUG flag. You are right that at least for things like `postpay_callback`, that we are going to be using in our flows, we should be using require_POST.