server side validation of whose turn it is