validate_hash() now accepts 'HEAD' too.