make callback optional to protect from bad client