Tests that disallowed form actions are blocked with GET and redirects.