Do not process serialized objects in the `deserialize()` function (see #6695)

Do not process serialized objects in the `deserialize()` function, so it is not vulnerable to PHP object injection in conjunction with raw POST data. Thanks to Pedro Ribeiro for his input.