POST requests should be idempotent, ideally. PUT requests certainly must be; it's their defining characteristic. GET requests, though, just shouldn't have side-effects at all.
(A /toggle URL isn't idempotent. If it were /open and /close it would be, but still shouldn't be GET.)
Yeah I think people are saying "GET shouldn't change state" and using idempotent incorrectly (which is more "hitting this multiple times shouldn't change things more than once").
