Restrict state-changing whitelisted endpoints to POST

Whitelisted methods that change data now accept only POST requests.