you could have left this
req.param searches both url and body parameters