moved validation logic into user model