Always use query args for the / endpoint parameters

This allows eventual future usage of 307 redirects and us accepting
POST requests without having to decode the request body.