Add test and fix to ensure that POST data is only embedded in the body, and not serialised in the URL