JSON by default
Update access rules
Require POST