https://gitlab.com/gitlab-org/gitlab/merge_requests/16463 moved
protected paths from Omnibus to the application settings, but
inadvertently included throttling on GET requests instead of just POST
requests. This change restores the previous behavior.

Part of https://gitlab.com/gitlab-org/gitlab/issues/34212