add test for "method not allowed" case