with the request sanity check this is not needed. but when i remove the `error 400;` line, we start exposing the hash. i would go for some extra redundancy here to prevent people from exposing the hash accidentally.