read json from request body.  return 400 when json is malformed.