moved validation from REST layer to Data Access layer