remove requirement that api auth requests be GET or POST

this is not necessary though we do still require that oauth exchange
requests use POST, per the spec