Get params from body only.

For safety, in case the uer has a column named 'id' which isn't the primary key
- where the id in the route would conflict.

Cheers to tobyink on IRC.