The currently accepted answer does work as expected but isn't the primary use case for the feature. Instead use the feature defined by ASP.NET. In my case, I denied everything but GET and POST:
With the code snippet above, MVC will correctly return a 404