Allow POST with Xs