Make every whitelisted write POST-only

Eleven of Draw's write endpoints were accepting GET requests, opening them to cross-site request attacks; now all whitelisted writes require POST.