* support separate HTTP method per query
* replace some deprecated permission code