真的被惊到了。restful 大行其道的今天不太明白为啥还有这种限制。https://security.stackexchange.com/questions/38635/how-is-http-put-and-delete-methods-insecure-if-they-really-are