Change POST to GET for request placement.

Unfortunately. POST was 'right', but protecting the submit endpoint
with Shibboleth only works with GET.  Config variable introduced to
switch back to POST, although not covered by tests at the moment.