adjusted validation of webservice (now checks permission of client)