[api] be more careful with body and form data

Support also HEAD requests by not crashing but mapping to a backend GET
(which is not perfect, but at least the clients get an answer [including body])