Verify that mutations are forbidden in GET requests

This ensures that GET requests do not execute mutations.

Changelog: security