Require post on workflow validation field.  

A sufficiently long workflow will overrun the maximum request length in most browsers, resulting in no validation taking place and a HTTP error.  Might want to also consider RequirePOST on the method in CpsFlowDefinition.