AbstractAuthentication::requiresAuthentication() ignores the `post_only` option and only checks the path.