only allow GET method to be proxied