Allow rules to match http verb

The rules engine is a very nice feature to use, but in some cases it falls short.

For example, I might have an API that I want to secure, where resource creation and management is limited to authorized users, and reading is public:

`GET /api/items` -> public
`GET /api/items/*` -> public
`POST /api/items` -> private
`PUT /api/items` -> private

The current rules options don't let me manage this, because the path is the same for many operations.

Instead, if I were able to filter by verb, I could easily setup a rule to forward to auth for all POST or PUT requests.

No file or test is named. Start by locating the rules engine and its request-matching entry point, then trace how paths and HTTP verbs are handled. Done means rules can distinguish requests using the same path by verb, including public GET access and authenticated POST or PUT access.

Written by the indexing model from the issue text.