XML api was broken by CSRF.

It uses a req.body STREAM to read XML. But the addition of express.urlencoded() body parser caused the body to already have been read and "parsed" into "json".

Fix by manually declaring the paths which require urlencoded bodies to get read.