Allow GET/POST to authorize instead only POST