In some cases our clean_param() is not good enough, the problem is that external systems do not expect our cleaning practices - for example external system sends invalid username in create user request, moodle would create user with different username - it should be much safer to throw exception instead