Restrict HTTP method the override can arrive in

[dougwilson]

This module will accept the method override from any method. It should probably be restricted to only certain methods (user configurable?) like only POST (the default?). The only real purpose for this module is to allow legacy systems to make a different method call than they are capable of, and really, every client can POST and POST requests typically contain bodies, so I don't see a use-case to accept method-overrides in other methods (you can always POST with no body as well).

@jonathanong @Fishrock123 @defunctzombie thoughts?

[Fishrock123]

Again, FWIW this is a response to http://blog.nibblesec.org/2014/05/nodejs-connect-csrf-bypass-abusing.html

Also see expressjs/csurf#8

[jonathanong]

yeah it should only support POST. doesn't make sense to me to support other original methods.