It was suggested to only allow GET/HEAD requests. Works if you don't have login forms.