protected boolean onLogoutRequestNotAPost(ServletRequest request, ServletResponse response) {

        HttpServletResponse httpServletResponse = WebUtils.toHttp(response);
        httpServletResponse.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
        httpServletResponse.setHeader("Allow", "POST");
        return false;
    }
This method is called when <code>postOnlyLogout</code> is <code>true</code>, and the request was NOT a <code>POST</code>.
For example if this filter is bound to '/logout' and the caller makes a GET request, this method would be invoked.
<p>
The default implementation sets the response code to a 405, and sets the 'Allow' header to 'POST', and
always returns false.
</p>

@return The return value indicates if the processing should continue in this filter chain.
web/src/main/java/org/apache/shiro/web/filter/authc/LogoutFilter.java