grant or deny access to the users or groups in regard to the HTTP methods
<system.web> <authorization> <deny verb="GET" roles="Admin" /> <deny verb="POST" users="*" /> </authorization> </system.web>