SECURITY: removed all http-method elements

 The HEAD method was not specified, which would lead to an authentication bypass similar to CVE-2010-0738. With no http-method elements, all methods are secured automatically.