allow only post request and validate json