Removed all http-method elements. The HEAD method was not specified, which would lead to an authentication bypass similar to CVE-2010-0738. With no http-method elements, all methods are secured automatically.