handle missing secObj in validate_doc_update() (fixes #164)