Tidy up the JSON request body handling

[rknLA]

#20 was a bit haphazard, and might require a bit more tidying and thought.

As mentioned in the post-mortem comments there, we need to make sure that we're checking Content-Type, and developing a reasonable strategy for error handling. My knee-jerk reaction is that if the body content isn't parsable by whichever parser we infer from Content-Type, then we should actually raise a 422 Unprocessable Entity here, instead of propagating the request any further down the pipe.