Add http_status_exceptions
[SECURITY] Restrict requests only via POST w/ XHR