HEAD isn't turned into GET, it's routed the same as a GET request. If it were actually turned into a GET request, then `request.get?` would have been true, and this exploit wouldn't have happened.

But I do agree with your point that routing of HEAD requests should be explicit.