Renamed CakeRequest::onlyAllow() to CakeRequest::allowMethod().

Existing name is unintuitive and it's not easily apparent what
the method does. Closes #2803
Updated bake templates to use CakeRequest::allowMethod()
Updated upgrade shell to change CakeRequest::onlyAllow() usages.
Merge pull request #2804 from ADmad/2.5-cakerequest

Renamed CakeRequest::onlyAllow() to CakeRequest::allowMethod().