only returning the body was a careless mistake, as it discards response
status and headers - however, checking the response status is useful
(everyone always seems to forget this), though it needs to be opt in

not happy with the option's name, but it seemed better than something
awkward like `validateSuccess` or `bodyOnly`