OPTIONS requests shouldn't be rate limited

Currently, refreshing a password reset request page (3 or more times) that does an `OPTIONS` to get fields, will block you from requesting the fields for a day.

We should only be rate limiting `POST` requests.

cc @meshy @Ian-Foote 
It improves failure messages - it's useful to know if it failed the first time through the loop or the third. Unfortunately I forgot this isn't a python `3.4` only library, so we can't use it.