allow only specified methods