We don't validate `content-type` anymore since #343, so what ever header they give we force the json decoding, later check for the _string_ version (if the json one fails).