allow all HTTP methods for the REST api