Enforce form-validation before reading the parameters

form validation happens only after data is already read.. this is why
the xss_clean attribute has no effect.