server-side validation (profile)