I decided to look in my own computer's applicationHost.config, used by IIS Express which is what Visual Studio runs, to see if there were any clues, and I found, in the <security> section,

<requestFiltering>
  <verbs allowUnlisted="true" applyToWebDAV="false" />
</requestFiltering>

I added that to web.config on the server and my requests started to work. They continued to work after I rolled back all the other changes I'd tried.