The toscawidgets.mods.pylonshf.valid is being called for both GET and POST requests. According to the toscawidgets.mods.pylonshf.valid doc string:
Given a TW form or dict of validators, valid() will attempt to validate
the form or validator dict as long as a POST request is made. No
validation is performed on GET requests unless post_only is False.
toscawidgets.mods.pylonshf.validate could be altered such that it only calls toscawidgets.mods.pylonshf.valid on a POST request. This will allow a pylons controller action to be decorated with validate and still be able to display a form as well as handle its data posted from that form.
