@api_view defaults to allowing GET