req.body is always an empty object