security bugfix for [gae]validate