change to GET only allowed