Instead of accepting serialized files, I wanted to process file uploads as multipart/form-data.
I also wanted to use the crsf prevention API.
This is what I came up with. Replace modulename with your module and fileupload with whatever you want to name your class/endpoint.
In your routing.yml: