disable request methods other than "GET|HEAD|POST|PUT|PATCH|DELETE"
stop hotlinking to static and bucket resources