req.method is correct