Update notes around request params and body deserialization.

Hopefully this makes things clearer for when we all forget why the
internal setter isn't used for storing the deserialized request body.
(i.e. avoids a side effect of calling decode on numerical values).

Thanks @xsaywerx for the prompt to explain it better!