Why forcing on `HEAD` ? We can make this configurable as well... In eZ 5 we use `AUTHENTICATE` custom verb.