session validation: don't throw a 400 error if the session_validation_key is not found on a post request