OPTIONS requests shouldn't be rate limited

Currently, refreshing a password reset request page (3 or more times) that does an `OPTIONS` to get fields, will block you from requesting the fields for a day.

We should only be rate limiting `POST` requests.

cc @meshy @Ian-Foote 
`subTest` would be good here to improve test output on failure.

```python
for i in range(rate_limit):
    with self.subTest(request_index=i):
        ...
```