bug: parse request body correctly