Although I have strict method switched on it allows me to call the save() and delete() method on any class.
It seems that the one in struts-default adds these as a default: <global-allowed-methods>execute,input,back,cancel,browse,save,delete,list,index</global-allowed-methods> I can see why we want some, possibly only have methods that are required for struts to function at a minimum. <global-allowed-methods>execute</global-allowed-methods>