Use only instead of except to limit routes used

It looks as though we were accidentally allowing the destroy route
to exist for whitelisted hosts, because we were excluding delete
instead of destroy. This fixes that issue.
Merge pull request #314 from alphagov/only_routes

Use only instead of except to limit routes used