Disallow HTTP methods other than GET/POST/HEAD

Thanks, simon90 @ HackerOne!