no-js protection, new validation