allow geoserver admin to GET