API: Make action=clearhasmsg require POST