Removed all http-method elements. The HEAD method was not specified, which would lead to an authentication bypass similar to CVE-2010-0738. With no http-method elements, all methods are secured automatically.
Merge pull request #26 from dfj/master

SECURITY: removed all http-method elements