moved express-validator middleware into hook