API stashes can expire, improved POST body validation