Reflecting on deserialization. Why you should explicitly decode your JSON