303 redirects should not use POST

Closes #618