submit() and publish() views now require POST (closes #31).