Filter requests to only allow json

Based on our discussion of #111. This just restricts allowable content to `application/json` or `application/patch+json` under the api namespace.