In the first round one of the POSTs was to be rejected because it was supposed to contain JSON but contained something else; that should have been made a 400.
You're acting as the firewall, not the application. That was not one of the rules for the day. In the first place a waf is specifically to stop malicious requests hitting the app.
[–] synotna 53 minutes ago