hook: receive just an io.Reader in AddHook
api: don't let the request body opened after adding a hook