Fix which paths forms are posted to.

Ensure that the `object/update-form/` paths only accept HTTP GET requests, and
`object/` paths accept both HTTP GET and HTTP POST requests.