We should probably constrain this to GET requests only as it appears to be a potential security problem: https://github.com/rails/rails/commit/56cdc81c

I believe the correct way to do this would be by adding `via: :get` to the end.