only allow get and post methods