Authorising POSTs and PUTs