* POST endpoints now accept only application/json.

  JSON was always supported, but we now explicitly reject
  regular form posts.

  Thanks to @kcwu and @favonia for pointing out a CSRF vector.