I'm fine with you validating it based on request methods -- wouldn't that amount to the same thing anyway? I.e. GET/DELETE are associated with request args and PUT/POST are associated with payload args?