Body trim hook iterates `for…in` instead of own keys

The pre-handler that trims string fields on `req.body` used `for…in`, walking the prototype chain. Brittle to any upstream prototype-pollution and not strictly correct.