Currently the user can run into NPE's when the request contains invalid json because the validator doesn't run in this case.