> the spec says that's illegal.

For a very long time, the spec did not say it's illegal. In fact, RFC 2616 (that has been defining the HTTP/1.1 for 15 years) says that

                                   A message-body MUST NOT be included in
    a request if the specification of the request method (section 5.1.1)
    does not allow sending an entity-body in requests. A server SHOULD
    read and forward a message-body on any request; if the request method
    does not include defined semantics for an entity-body, then the
    message-body SHOULD be ignored when handling the request.