Both grants. The body is form-encoded, as the RFC says, and JSON is accepted too because some clients send it.

Every answer is built here rather than returned as a dict, so the no-store headers are on the response itself. Relying on an injected Response put them on failures and missed every success -- the one case where the body actually is a credential.

Async only to read the body (_body); the rest -- Mongo, and the .env config() reads -- runs on a worker thread, not on the loop every other request shares.