OPTIONS requests shouldn't be rate limited

Currently, refreshing a password reset request page (3 or more times) that does an `OPTIONS` to get fields, will block you from requesting the fields for a day.

We should only be rate limiting `POST` requests.

cc @meshy @Ian-Foote 
Oops, sorry - we can't use `subTest` on this project. It requires python `3.4`