Index: package_branches/invirt-web/cherrypy/code/main.py
===================================================================
--- package_branches/invirt-web/cherrypy/code/main.py	(revision 2421)
+++ package_branches/invirt-web/cherrypy/code/main.py	(revision 2422)
@@ -147,4 +147,34 @@
     help._cp_config['tools.require_login.on'] = False
 
+    def parseCreate(self, fields):
+        kws = dict([(kw, fields.get(kw)) for kw in 'name description owner memory disksize vmtype cdrom autoinstall'.split()])
+        validate = validation.Validate(cherrypy.request.login, cherrypy.request.state, strict=True, **kws)
+        return dict(contact=cherrypy.request.login, name=validate.name, description=validate.description, memory=validate.memory,
+                    disksize=validate.disksize, owner=validate.owner, machine_type=getattr(validate, 'vmtype', Defaults.type),
+                    cdrom=getattr(validate, 'cdrom', None),
+                    autoinstall=getattr(validate, 'autoinstall', None))
+
+    @cherrypy.expose
+    @cherrypy.tools.mako(filename="/list.mako")
+    @cherrypy.tools.require_POST()
+    def create(self, **fields):
+        """Handler for create requests."""
+        try:
+            parsed_fields = self.parseCreate(fields)
+            machine = controls.createVm(cherrypy.request.login, cherrypy.request.state, **parsed_fields)
+        except InvalidInput, err:
+            pass
+        else:
+            err = None
+        cherrypy.request.state.clear() #Changed global state
+        d = getListDict(cherrypy.request.login, cherrypy.request.state)
+        d['err'] = err
+        if err:
+            for field in fields.keys():
+                setattr(d['defaults'], field, fields.get(field))
+        else:
+            d['new_machine'] = parsed_fields['name']
+        return d
+
     @cherrypy.expose
     @cherrypy.tools.mako(filename="/helloworld.mako")
@@ -219,8 +249,7 @@
         @cherrypy.expose
         @cherrypy.tools.mako(filename="/command.mako")
+        @cherrypy.tools.require_POST()
         def command(self, command_name, machine_id, **kwargs):
             """Handler for running commands like boot and delete on a VM."""
-            if cherrypy.request.method != "POST":
-                raise InvalidInput("request.method", command_name, "You must execute commands via POST")
             back = kwargs.get('back', None)
             try:
@@ -337,31 +366,4 @@
             return 'location' in d
     return False
-
-def parseCreate(username, state, fields):
-    kws = dict([(kw, fields.getfirst(kw)) for kw in 'name description owner memory disksize vmtype cdrom autoinstall'.split()])
-    validate = validation.Validate(username, state, strict=True, **kws)
-    return dict(contact=username, name=validate.name, description=validate.description, memory=validate.memory,
-                disksize=validate.disksize, owner=validate.owner, machine_type=getattr(validate, 'vmtype', Defaults.type),
-                cdrom=getattr(validate, 'cdrom', None),
-                autoinstall=getattr(validate, 'autoinstall', None))
-
-def create(username, state, path, fields):
-    """Handler for create requests."""
-    try:
-        parsed_fields = parseCreate(username, state, fields)
-        machine = controls.createVm(username, state, **parsed_fields)
-    except InvalidInput, err:
-        pass
-    else:
-        err = None
-    state.clear() #Changed global state
-    d = getListDict(username, state)
-    d['err'] = err
-    if err:
-        for field in fields.keys():
-            setattr(d['defaults'], field, fields.getfirst(field))
-    else:
-        d['new_machine'] = parsed_fields['name']
-    return templates.list(searchList=[d])
 
 
@@ -653,5 +655,4 @@
 mapping = dict(
                modify=modify,
-               create=create,
                unauth=unauthFront,
                admin=admin,
Index: package_branches/invirt-web/cherrypy/code/view.py
===================================================================
--- package_branches/invirt-web/cherrypy/code/view.py	(revision 2421)
+++ package_branches/invirt-web/cherrypy/code/view.py	(revision 2422)
@@ -83,4 +83,12 @@
 cherrypy.tools.require_login = cherrypy.Tool('on_start_resource', require_login, priority=150)
 
+def require_POST():
+    """If the request isn't a POST request, raise 405 Method Not Allowed"""
+    if cherrypy.request.method != "POST":
+        raise cherrypy.HTTPError(405,
+                                 "You must submit this request with POST")
+
+cherrypy.tools.require_POST = cherrypy.Tool('on_start_resource', require_POST, priority=150)
+
 def remote_user_login():
     """Get the current user based on the SSL or GSSAPI environment variables"""