[api] must provide both path & content for POST /stashes, adjusted tests