API endpoints should probably expect POST instead of GET

[ItsElaineTime]

Browsers, especially mobile ones, may re-send GETs because they're not supposed to have side effects.

[djcapelis]

I don't believe we have anything that causes an undesirable side effect in our API. At worst you might rate a current player the same way you rated a previous one. I think this can be closed?

[ItsElaineTime]

The admin stuff scared me more than the public stuff, especially if the only way to reset the leader board is to hit a URL manually. (I might throw up a button that requires one of those type a phrase to confirm things.)

I've since started pinging the admin endpoints via XHR so it never leaves a history entry, so I'm less worried about this. I wanna call this polish or p3 or whatever for now.