added server-side validation
fixed a lot