Rails only accepts certain http verbs. It is simple enough to tell apache to limit access to passenger
It can also live at the directory or server config level
<VirtualHost *:80>
ServerName plm.local
DocumentRoot "/Users/kbrock/projects/plm-website/public"
RailsEnv development
<Directory "/Users/kbrock/projects/plm-website/public">
<LimitExcept POST GET PUT DELETE OPTIONS>
Order deny,allow
Deny from all
</LimitExcept>
</Directory>
</VirtualHost>