serializer tests: do not pseudo-test deserialization by supplying "params"; supply "body".
handle deserialization failures properly: return 400. content deserialization is NOT optional.