Allow GET and HEAD request, disable others

Add middleware spec