use md5 not sha256 (my bad)
add note about content-types
initial support for POST endpoint