what kind of validation? if it is not an inflight session, server side returns a 404. if it is null, it returns 400.