OPTIONS requests shouldn't be rate limited

Currently, refreshing a password reset request page (3 or more times) that does an `OPTIONS` to get fields, will block you from requesting the fields for a day.

We should only be rate limiting `POST` requests.

cc @meshy @Ian-Foote 
From the issue:
> We should only be rate limiting POST requests.

```python
if request.META['REQUEST_METHOD'] != 'POST':
    return True
return super().allow_request(request, view)
```