always capture body for POST requests (fixes signup)
take path option into account; use hex filenames
fix OAuth self -> this