OPTIONS requests shouldn't be rate limited

Currently, refreshing a password reset request page (3 or more times) that does an `OPTIONS` to get fields, will block you from requesting the fields for a day.

We should only be rate limiting `POST` requests.

cc @meshy @Ian-Foote 
You could add a helper method to make this more DRY. Something like:
```python
def check_post_rate_limit(self, view, data, expected_status):
    request = self.create_request('post', data=data, auth=False)
    response = view(request)
    self.assertEqual(response.status_code, expected_status)
```