Under REST, `POST` would create a new resource (we'd use `PUT` to update and `DELETE` to delete, and of course `GET` to read). The REST pattern would require that we identify the account elsewhere by a unique URI. 

An alternate pattern is to simply use `POST` for everything besides read, and then encode the create/update/delete information a different layer, namely, in the request body. (I thought there were browser XHR limitations with other verbs that make this alternate pattern useful, but I'm not coming up with links on that right now.)

The implementation I'm seeing here is neither REST nor this alternate pattern. Granted, we have pretty much zero rationality to our API to date, so I don't have much to stand on here. Are we deleting via plain `POST` on other endpoints?