better request body checks