restrict request methods