improve SignedRequest validation to minimize confusion bug