Go-ethereum: Disallow PUT and DELETE on HTTP RPC

[karalabe]

Our HTTP RPC endpoint currently accepts requests on all request verbs (https://github.com/ethereum/go-ethereum/issues/15490#issuecomment-344618139). Perhaps we shouldn't do so blindly to avoid weird combinations that could potentially circumvent CORS? Would be nice to drop support for PUT and DELETE altogether, and think a bit about the others.

[armaniferrante]

I can grab this.

What's the desired response and message for PUT and DELETE requests? 405 with any particular wording (if not we can probably just use Go's http.StatusText method for the error message)?

[karalabe]

You can use "method not allowed". That's usually the style with Go's built in HTTP errors too, just a lowercase string of the error itself.