I think doing this check in `post()` would be better since processing the form for an invalid request seems a waste and potentially a vulnerability point. I think this would also show form errors if the form was invalid to a user that could never successfully submit the form anyway.