validated json-rpc works via exo_http