Add requestkey extension (CSRF mitigation)
Allow only POST requests to /service/update