reworked top level middleware to allow POST