default behavior only checks header

This changes the default behavior to just look in the header only,
because looking in the body is not very standard and has the
additional complexity that the body must be fully parser before
this middleware can be invoked, which is very limiting, especially
with multipart/form-data or other large bodies.

Using HTTP headers is also much more common that body contents.