Refactors CanBeHeroAuthorization to rely on request.DATA to parse request body, rather than assuming JSON (bug 951353)

r? @cvan @diox