make things more flexible by putting the query in the request body; some sanity-checking on requests; handle all HTTP verbs