Use body-parser instead of express.json.

The body parser bundled with Express doesn't support x+json Content
Types. Thanks for discovering, @drobbins.
Replace / with _resource_ in Postman collection.
Use application/hal+json to update permissions