It is recommended that a whitelisting approach be taken to explicitly
permit the HTTP methods required by the application and block all
others.

Typically the only HTTP methods required for most
applications are `GET` and `POST`. All other methods perform actions
that are rarely required or perform actions that are inherently risky.
These risky methods (such as `PUT`, `DELETE`, etc) should be protected
by strict limitations, such as ensuring that the channel is secure
(SSL/TLS enabled) and only authorised and trusted clients are
permitted to use them.