hmac validation takes priority over normal validation