Only enable protected paths for POST requests

Merged Stan Hu requested to merge sh-fix-protected-paths into master

!16463 (merged) moved protected paths from Omnibus to the application settings, but inadvertently included throttling on GET requests instead of just POST requests. This change restores the previous behavior.

Part of #34212 (closed)

Edited by Stan Hu