Stats access event listener only listens to HTTP GET

The stats access event listener only listens to `stats.get` so requests using `HTTP HEAD` does not get authenticated.