OnValidate is being fired for regular webForms, when there is no file.field bound to the control, and pbServerOnValidate is set to c_WebDefault.

For regular controls, (not data-bound), if set to cWebDefault this should resolve to False, by default. The documentation does not say that explicity, but let this rule in mind by stating the opposite.
If the control has a data binding (Entry_Item) and is set to C_WebDefault, this property will be automatically set to True if the corresponding DataDictionary's Field_Validate_msg property is set.
This should not be happening. Waste of round-trip call. as there is nothing to validate on the server side.

This can be reproduced in webOrderMobile.

Change login dialog, just implementing the OnValidate method for the oLoginName webform.

Code:
    Object oLoginName is a cWebForm
        Set psLabel to "User ID:"
        Set peLabelPosition to lpTop
        Set piMaxLength to 20
        Set piColumnIndex to 1
        Set pbShowLabel to False
        Set psPlaceHolder to "loginname"
        Set piColumnSpan to 10

        Function OnValidate Returns Boolean
            Boolean bRetVal
            Forward Get OnValidate to bRetVal
            Showln 'onvalidate'
            Function_Return bRetVal
        End_Function
    End_Object
Compile, run it.
type anything in the login name form, and tab to exit the form.
onValidate will be fired.

Regards