server-side validation (logs)