Make all modifications be POST rather than GET #116

For example, clicking change status -> waiting on author generates a GET request to /patch/xxx/status/author/. This triggers a lot of crawlers to hit such URLs, which will then generate a redirect for a login since they can't actually modify it. But given the large number of such links this can generate a lot of requests and load. And as a side effect, it can also be used to trick people into clicking the wrong link..