Kill 'the JSON API body'

This is just step one. There are a few unauthenticated scenarios that still use one step