allow GET requests to api