req.validate uses _.defaults instead of _.extends