add no permit for add/delete/update with get instead post