api: better user validation