As for disabling TRACE, there is a property named "traceEnabled" under <http-service>, which can be set to "true" or "false".
Unfortunately, there is no such property for the remaining HTTP methods.
[Message sent by forum member 'jluehe' (jluehe)]
http://forums.java.net/jive/thread.jspa?messageID=279260