Do you need to guard against `req.body` being null, or at least not being of the form you expect?