list POST, GET return forbidden whe not allowed endpoint-level tests; view-level ones now unnecessary so deleted