403 when authentication headers are sent

[djanowski]

The redirect is convenient, but if you're using authentication headers, the fact that the web server processes the request can lead to insecure behavior: developer sends secret token over HTTP, and if the client library automatically follows redirects, everything works, but the token was exposed.

I suggest you respond with 403 when using authentication, similar to what you do with non-GETs.