Should we also require the `Content-Type` header on the request specifying `application/json`?

It may be overhead for just this case, but may allow to support other execution code, like `application/x-www-form-urlencoded` for submitting a form maybe?

Just food for thought, I'm not strongly opinionated about this one.