use request.raw_post which should be a bit safer