is this not a basic rest principle? URLs and req/res bodies are the only way to transfer anything so they must be the way to transfer state