re-added held-out validation, and it does a lot worse than crossval, which means crossval is broke