whoops, only check the nonce when request is a POST