Your app's form is not the only way into your API. Anyone can send requests with curl or a script, carrying any body they like, so the server must check everything that arrives.