added deny rules; also skip validation on client