I suggest you use Django's [`require_GET` decorator](https://docs.djangoproject.com/en/dev/topics/http/decorators/):

```python
from django.views.decorators.http import require_GET

@require_GET
@login_required
def orphan(request, course_id):
    return JsonResponse(modulestore().get_orphans(course_id, DETACHED_CATEGORIES, 'draft'))
```

If any non-GET requests hit that endpoint, they'll receive a 405 Method Not Allowed response.