Forbid POST to restricted URLS instead of redirecting.
Add ghost changelog.