Authorize user only on unsafe methods, fixes #18