Reject unexpected HTTP Methods on endpoints

[glanham-jr]

If an endpoint does not expect HTTP POST, then reject it with a 405 (not allowed). This is a security issue, as we want to minimize the attack surface which users can call the server.