@Kusal, thanks for the detailed info.
I wondered how permittedMethods allows multiple values, so I searched in Confluence source code (an old download, before source-downloads were hidden…), and found the docu in com.atlassian.xwork.interceptors.RestrictHttpMethodInterceptor, that it’s a comma-separated list:
/** ...
An example of the parameter configuration:
<action name="blah" class="com.example.MyAction">
<param name="permittedMethods">GET, POST, PUT</param>
<result name="success" type="redirect">/index.html<result>
</action>
Note that method names are case sensitive, and all upper case. They must correspond to one of the values of the HttpMethod enum.
...
*/
I agree with @scott.dudley that some public documentation is needed for this, especially now that with Confluence 9 this gets required!