req.body is already in json