Avoid returning a 304 status when not permitted

As per RFC 2616 section 10.3.5, a 304 status should only be returned in
response to a successful conditional GET request.

> If the client has performed a conditional GET request and access is
> allowed, but the document has not been modified, the server SHOULD
> respond with this status code. The 304 response MUST NOT contain a
> message-body, and thus is always terminated by the first empty line
> after the header fields.

http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.5

This change prevents returning a 304 status when the request method is
not HEAD or GET, and when the response status is not 200.