add validation and authentication