Also check if access_token in req.body

Allow flexibility of verifying access_token in req.body for POST methods.