GitLab

(when GET is not allowed).

Addresses browsers being able to POST without control due to things like
https://bugzilla.mozilla.org/show_bug.cgi?id=429594

Allowing methods isn't as simple as just allowing/disallowing them because
different methods do different things.

* HEAD: should be allowed everywhere GET is allowed.
* OPTIONS:
  * When a CORS request is made, this will be handled by the CORS library.
  * Otherewise, we need to return the allowed methods.
* POST: always allowed.
* Everything else: always denied.

Changing HandledMethods to a simple AllowGet makes it easier to "do the right
thing".

This Handler option is used it to allow/deny request by their method.

The API is an RPC API so it normally should only work with PUT, but we also
use a read-only, GET-based partial API that runs with the gateway.

This commit makes the actual allowed (or handled) methods configurable.

A test is added, and test facilities improved to be able to set/modify
this option.

This:

1. Ensures the correct content type.
2. Tells browsers not to sniff the content type.

This prevents any nasties from happening...

These should cover the bugs uncovered when trying to update go-ipfs-cmds in
go-ipfs.