Accept token in request body.
Removed rescuing to 500. In production, this is implicit.