allow get methods only