HTTP methods have little to do with security in and of themselves. A method like
DELETE /users/1 could easily also be implemented as
POST /users/1/delete or even
GET /users/1/delete (GETs should never have side effects, but that doesn't stop some developers from doing so anyway).
You should therefore treat them similarly to any other HTTP method. GETs should not change server state, so typically you would only need to verify that the client has read access to the requested resource. PUTs should be used to update a resource wholly in-place (although they are often also used similarly to the PATCH verb), and so you should ensure that the client has the privileges to do this. Likewise, DELETE should be sent in order to request that a resource be deleted. So you would want to ensure a user has permission to do so.
In short: treat the verbs as descriptors of the type of action the user wishes to perform. Authenticate and authorize them to perform these actions as is required by the security parameters of your particular application.