added server-side validation