Get the controller and user (as created by the decorators).

Return the JSON data submitted in the request body.

Removes the query (which is potentially personally identifiable information) from the URL.