The http.StatusMethodNotAllowed status code was being erroneously set instead of http.StatusBadRequest in multiple places. Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>