API: Insist authn parameters be in the POST body