Set Allow header for 405 responses

The HTTP spec says this is a MUST:

http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.7

Also swap `http.Error()` for the shorter-hand `w.WriteHeader()`, with a spec
assertion that we're returning the correct status reason.