now the server does the validation