Constrain diagnostic routes to GET method

I believe that this change will fix the diagnostic routes from getting roped into policies filtering by non get verbs. For example the AntiForgery policy would apply itself to all POST actions. Because diagnostic routes are not constrained they were getting included in CSRF validation checks.