reworked server side validation, added expiration check