title: method not allowed, when using onlyajax in controller action
body: <p><strong>Background:</strong></p>
  
  <p>I'm attempting to make good RESTful APIs in cakephp, and delegate front end work to a front end templating language Handlebars. As elicited here (<a href="http://www.dereuromark.de/2014/01/09/ajax-and-cakephp/" rel="nofollow noreferrer">http://www.dereuromark.de/2014/01/09/ajax-and-cakephp/</a>) , using the JsonView and making an extensionful api is a good approach.</p>
  
  <p><strong>Problem:</strong></p>
  
  <ol>
  <li>Allowing only ajax by using <code>$this-&gt;request-&gt;onlyAllow('ajax');</code> is returning method not allowed. I want to enforce this so my APIs are not directly called from the browser.</li>
  <li>Could you (the community) validate my approach to building such APIs.</li>
  </ol>
  
  <p><strong>Code:</strong></p>
  
  <pre><code>    //At the controller
          public function joinWithCode() {
                  //$this-&gt;request-&gt;onlyAllow('ajax');  //returns 405 method not allowed
                  //$this-&gt;request-&gt;onlyAllow('post'); //works and does not allow access from browser
                  $this-&gt;response-&gt;type('json');
                  $data = array(
                      'content' =&gt; 'something',
                      'error' =&gt; 'something else',
                  );
                  $this-&gt;set(compact('data'));
                  $this-&gt;set('_serialize', 'data');
          }
  //routes.php
  Router::parseExtensions('json');
  Router::connect('/Classrooms/join', array('controller' =&gt; 'classrooms', 'action' =&gt; 'joinWithCode'));
  </code></pre>
  
  <p>The post attempt from the postman extension:
  <img src="https://i.stack.imgur.com/8cDkT.png" alt="The post attempt from the postman extension"></p>