Only allow GETs of embedded assets