req validations should only check once if req.body is an object