disallow post requests to the dashboard