Why are you skipping the validation based on the format header? It looks like a potential security problem.