That's because the raw request body is just being proxied to the candlepin, but katello is the one to do the authorization. Something really needs to be here to handle this, otherwise it would be a huge security hole