serve: allow POST and GET methods