Use require_http_methods to restrict signin to POST

This sends a 405 Method Not Allowed for a GET request, which is the
right response.