method not allowed plays nicely with four-oh-four

lower level specs to verify router behavior