only allow GET method for login/logout actions