Use body for JSON, not a request parameter
use protect_from_forgery with: :null_session on API calls
Merge pull request #9 from ploslabs/feature/use_body_for_json

Use body for JSON, not a request parameter