always validate middleware schema against payload