using req.body instead of params for the params paramter