Only support HTTP GET on most routes

With the exception of the main publication method (which uses POST to handle some "places" and "local transactions") most of our routes only need to support HTTP GET. Explicitly restricting them to GET makes them easier to cache.

We may be able to also make changes to the remaining code to limit it to GETs but that's a larger and separate piece of work.

fao @nickstenning