remove use of requestAttributes, refactor schema validation into `model.set`