auth: further sanitize requests to prevent GET CSRF (CVE-2016-3691) Routes allows GET requests to override the HTTP method, which breaks the Kallithea CSRF protection (which only applies to POST requests). This commit blocks such GET request, preventing CSRF attacks.

[tox]
minversion = 1.8
envlist = py{26,27}-{pytest,nose}

[testenv]
setenv =
    PYTHONHASHSEED = 0
deps =
    nose: nose
    pytest: pytest
commands =
    nose: nosetests {posargs}
    pytest: py.test {posargs}