I hadn't noticed this before, but pulling out validation into a separate method seemed reasonable... until I noticed that you are also mutating it in there.  Given that, this isn't about validation, this is about validation and other stuff, all of which is in service of handling HTTP POST requests.  So.... pull it back up there, please.