API description for /sessions#1.2_action_validate requires 'tokenId', but doesn't use it

When looking in the XUI at the API descriptor under the "/sessions" section, I can see that (for example) there is

/sessions#1.2_action_validate

and

/sessions/{userToken}#1.2_action_validate

The first describes a path parameter called "tokenId" which it says is "required". The second describes a path parameter called "userToken" which it also says is "required". In fact these are one and the same parameter and these are one and the same endpoint. This is presumably the same for all these other endpoints action_deleteproperty, actiongetidle, action_getmaxidle, etc. etc.