Only allow POST requests to ping endpoint

src/server-main.js

@@ -231,7 +231,7 @@ app.use('/api/users', usersPublicRouter);
 
 // Everything below this line requires authentication
 app.use(requireLoginMiddleware);
-app.use('/api/ping', (request, response) => {
+app.post('/api/ping', (request, response) => {
     if (request.query.extend && request.session) {
         request.session.touch = Date.now();
     }