added server validation (checks if user is logged in the server, not just client side)