Should we also verify that HEAD requests don't have a body?