autocompletion: Use 'POST' instead of 'GET' method to access API

This prevents including the search term in webserver logs.
It will also break all clients using this API endpoint, which is
fine, as non-OCS APIs are meant to be private and shouldn't be used
by 3rdparty apps.