fixes #233 - allows token in methods where the request body is allowed